Download Practical#7

RASHTRIYA RAKSHA UNIVERSITY
(An Institution of National Importance)
Pioneering National Security and Police University of India
Practical#7
Program:
M.Sc. IN CYBER SECURITY AND DIGITAL FORENSICS
Semester:
3
Subject:
Cloud Security and Forensics
Subject Code:
M3B15CSF
Practical: Understanding and Mitigating DoS Attacks on AWS Free Tier
Objective: Gain practical insights into Denial-of-Service (DoS) attacks and explore fundamental mitigation
strategies utilizing AWS services available within the Free Tier.
Sr. No.
1
Particulars
Set Up an EC2 Instance:
Launch a t2.micro EC2 instance in the AWS Free Tier.
Configure Security Groups:
Create two security groups: one for normal traffic and one for testing DoS attacks.
•
2
Normal Security Group: Allow necessary traffic (SSH for management, HTTP/HTTPS for web
applications) to facilitate regular operations.
•
DoS Testing Security Group: Restrict all incoming traffic except for the specific ports used
during DoS simulations. This controlled environment prevents unintended disruptions to
other services.
Deploy a Basic Application:
3
•
Deploy a simple web application on the EC2 instance. For example, you can use a static HTML
page or a lightweight web server like Apache or Nginx.
•
Make the application accessible over HTTP. This will serve as the target for DoS attacks.
Utilize Apache Benchmark for Load Testing:
1. Install Apache Benchmark on a local machine or another EC2 instance.
•
4
On a local machine: Install the apache2-utils package using your system's package
manager (e.g., apt, yum, dnf).
•
On another EC2 instance: Follow the same installation process as on the local machine.
2. Test the normal operation of the web application using Apache Benchmark.
Lavad - Dehgam - 382305 Gandhinagar, Gujarat, INDIA
Phone : +91 79-68126800, Fax : +91 79-68126820, Website : www.rru.ac.in
RASHTRIYA RAKSHA UNIVERSITY
(An Institution of National Importance)
Pioneering National Security and Police University of India
•
Execute the command to simulate 100 concurrent requests for the application's
homepage.
ab -n 100 -c 10 http://your-ec2-instance-ip/
Verify the application's responsiveness and resource utilization using CloudWatch.
Simulate a DoS Attack:
1. Increase the load with Apache Benchmark to simulate a DoS attack.
•
Execute the command to simulate 100 concurrent requests for the application's
homepage.
5
ab -n 1000 -c 100 http://your-ec2-instance-ip/
2. Observe the impact on the application's responsiveness and resource utilization using
CloudWatch.
•
Monitor CPU usage, network traffic, and other relevant metrics to assess the impact of
the simulated attack.
Implement AWS WAF (Optional):
1. Create an AWS WAF using the AWS Management Console.
2. Configure a WebACL (Web Application Control List) to block requests that match certain
6
conditions, such as high request rates or suspicious patterns.
3. Associate the WebACL with the DoS Testing Security Group to protect the application from
DoS attacks.
4. Re-test with AWS WAF Enabled.
Report
7
Please prepare a concise report on the practical tasks you've completed and submit it through
the Canvas platform before the specified deadline.
Important Notes:
Ethical Considerations:
Conduct the test ethically and within legal boundaries.
8
Avoid causing disruption to production environments.
Legal Compliance:
Ensure proper authorization for penetration testing in the AWS environment.
Cleanup:
Delete all created AWS resources to avoid unnecessary costs.
Lavad - Dehgam - 382305 Gandhinagar, Gujarat, INDIA
Phone : +91 79-68126800, Fax : +91 79-68126820, Website : www.rru.ac.in